fix(review): address Baz and Gitar threads on safe-execute dispatch\n\n- Deduplicate safe-execute payload in run-unit-tests coverage limit path by using safeExecuteLimitResult()\n- Reserve maxToolCalls slots before any awaited work and roll back on denial\n- Evict safe-execute per-execution counter after the terminal outcome is reported\n- Keep fail-closed scope behavior for destination-mode safe and non-safe paths view more